Home

zig-sdk

zig-sdk is the unofficial Zig SDK for the Model Context Protocol (MCP)¹. It gives you a server library, a client library and five transports: stdio, Streamable HTTP, gRPC, Unix socket and WebSocket. It has no dependency other than the Zig toolchain². The SDK obeys one specification revision, 2026-07-28, and no older revision³.

Applies to: MCP 2026-07-28, Zig 0.16.0, zig-sdk 0.1.0. A row that names a version applies to that version of zig-sdk and later.

What the SDK gives you

Part	State
Protocol types for the full 2026-07-28 schema	Done. Tested against the official example fixtures.
Server engine: tools, resources, resource templates, prompts, completion, pagination	Done.
Multi round-trip requests with sealed request state	Done.
Subscriptions (subscriptions/listen)	Done.
JSON Schema 2020-12 validation of tool arguments and structured output	Done. Version 0.1.0 has a subset. Version 0.2.0 has all keywords of 2020-12. The JSON Schema Test Suite checks it. Remote references and custom meta-schemas stay out. See JSON Schema Support.
stdio transport (server and client)	Done.
Streamable HTTP transport (server and client)	Done. Passes all 37 scored scenarios of the official conformance suite.
TLS 1.3 server (HTTPS)	Done. Tested against the std client, curl and openssl.
RSA certificate keys and the X25519MLKEM768 hybrid key exchange	Version 0.2.0. See TLS and Certificates.
AEGIS cipher suites, record padding, RSA-PSS keys, certificate_authorities, name constraints and revocation	Version 0.2.0. See TLS and Certificates.
TLS 1.3 client	Done. See TLS and Certificates.
Client with in-memory, stdio and Streamable HTTP transports	Done.
The log level and more _meta entries for one request, and notifications in the order of arrival	Version 0.4.0. See Client Guide.
HTTP proxies for the HTTP client and the OAuth client	Version 0.4.0. See Client Guide.
OAuth 2.1 authorization client	Done. Passes every scored auth/* scenario of the official suite.
Authorization helpers for resource servers	Done. Bearer checks, metadata and JWT verification.
OAuth 2.1 authorization server	Version 0.2.0. See Authorization Server.
Refresh tokens and token storage in the keychain of the host	Version 0.2.0. See Authorization.
Time limits for the keychain storage on Linux	Version 0.5.0. See Authorization.
OAuth client credentials and enterprise-managed authorization extensions	Version 0.2.0. See Authorization.
DPoP-bound tokens and workload identity federation (draft authorization extensions)	Version 0.2.0. See Authorization.
gRPC transport (JSON-RPC tunnel over HTTP/2)	Done. See Transport gRPC.
Typed gRPC binding of the Google Cloud proto files	Version 0.2.0. See Transport gRPC.
Unix socket transport (server and client)	Version 0.2.0. See Transport Unix Socket.
WebSocket transport (server and client)	Version 0.2.0. See Transport WebSocket.
Rate limits for each caller	Version 0.2.0. See Limits and Security.
Tasks extension	Done. See Tasks Extension.
Skills extension	Version 0.2.0. See Skills Extension.
MCP Apps extension	Version 0.2.0. See Apps Extension.
Client icon rules	Version 0.2.0. See Client Guide.

Where to start

• Getting Started tells you how to add the SDK to a Zig project and run the first server.
• Concepts explains the stateless protocol model of revision 2026-07-28.
• Server Guide and Client Guide describe the two libraries.
• Transports compares stdio, Streamable HTTP, HTTPS, the gRPC binding, the Unix socket transport and the WebSocket transport. A page for each transport describes it: Transport stdio, Transport Streamable HTTP, Transport gRPC, Transport Unix Socket and Transport WebSocket.
• Resource Templates describes the URI templates of resources. JSON Schema Support describes the validator of tool arguments and structured output.
• Authorization describes the OAuth clients and the checks of a protected server. Authorization Server describes the authorization server.
• TLS and Certificates describes the TLS 1.3 server and client, and the checks of certificates.
• Tasks Extension, Skills Extension and Apps Extension describe the optional extensions.
• API Reference links the reference of each module on the documentation site. Examples describes the example programs.
• Deploy Reverse Proxy tells you how to put the HTTP server behind nginx or Caddy.
• Conformance shows the results of the official conformance suite.
• Threat Model maps the security requirements to modules and tests. Limits and Security lists the limits and their default values.
• Roadmap lists the milestones. Release Notes lists the changes of each release.
• The project zig-bridge-sdk is the bridge for hosts of revision 2025-11-25, for example VS Code. Its wiki page VS Code tells you how to use it.

How the wiki is written

Every page uses the project profile of ASD-STE100 Simplified Technical English⁴. See the Style Guide and the Dictionary. Every page cites its sources with numbered references that point to the Bibliography.

References

1. MCP-SPEC-2026-07-28: Model Context Protocol Specification 2026-07-28.
2. ZIG-0.16-RELNOTES: Zig 0.16.0 release notes.
3. MCP-VERSIONING-2026-07-28: Versioning of the specification.
4. STE100: ASD-STE100 Simplified Technical English, Issue 9.